{"id":"CVE-2026-84164","kind":"vulnerability","aliases":["CVE-2026-84164"],"related":[],"title":"CodeChecker: HTML report lets a crafted finding inject script","description":"The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML.\n\n\n\n\nThe input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.","summary":"The HTML reports generated by CodeChecker and plist-to-html place report messages, checker names and file paths inside a script block using json.dumps, which does not escape the less-than character. A closing script tag in any of those fields breaks out of the script element, so the attacker's markup runs in the browser of whoever opens the report.","severity":"medium","cvss":0.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["codechecker","gerrit","jenkins","package","plist-to-html","report-converter"],"not_affected_if":["csp-enforced","local-only-reports","trusted-input"],"how_to_check":"- Check whether the installed `report-converter` or `codechecker` package is an affected version (versions unknown from the sources)\n- Find whether HTML reports from `CodeChecker parse --export html` or `CodeChecker cmd diff --output html` are published to a shared location such as Jenkins userContent or a web server without a Content-Security-Policy","fix":null,"status":"open","published_at":"2026-11-06T11:17:17+00:00","first_seen_at":"2026-11-06T11:41:29+00:00","triaged_at":"2026-11-06T11:44:01+00:00","updated_at":"2026-11-06T11:44:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T11:44:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CodeChecker: HTML report lets a crafted finding inject script","impact":"medium","summary":"The HTML reports generated by CodeChecker and plist-to-html place report messages, checker names and file paths inside a script block using json.dumps, which does not escape the less-than character. A closing script tag in any of those fields breaks out of the script element, so the attacker's markup runs in the browser of whoever opens the report.","audience":"developers","category":"package","nicknames":[],"who_cares":["codechecker","report-converter","plist-to-html","jenkins","gerrit"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in a viewer's browser on the report host","analyst_note":"Find the affected and fixed versions of report-converter and CodeChecker from the vendor advisory on github.com.","how_to_check":"- Check whether the installed `report-converter` or `codechecker` package is an affected version (versions unknown from the sources)\n- Find whether HTML reports from `CodeChecker parse --export html` or `CodeChecker cmd diff --output html` are published to a shared location such as Jenkins userContent or a web server without a Content-Security-Policy","plain_action":"","needs_analyst":true,"not_affected_if":["csp-enforced","local-only-reports","trusted-input"],"who_is_affected":"Teams that generate HTML reports from CodeChecker or plist-to-html and publish them where others open them, especially when the analysed code or third-party result files are not fully trusted. The sources say Jenkins userContent under a restrictive CSP would likely block the injected inline script, but the generated report sets no CSP of its own, so reports served without one are exposed. Teams that only read reports locally from trusted input can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000775,"input_tokens":4455,"output_tokens":659,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-84164':12A,15A 'analys':165C 'attack':78B 'author':160C 'block':49B,124C,227C 'break':70B 'browser':84B 'caveat':211C 'charact':60B,135C 'checker':41B,114C 'close':62B,138C 'cmd':104C,186C 'codecheck':1A,16B,32B,98C,103C 'configur':238C 'control':163C 'convert':26B,177C 'craft':6A 'csp':224C,244C 'cve':10A,13A 'destin':233C 'diff':105C,187C 'docs/jenkins_gerrit_integration.md':194C 'document':195C 'element':75B,150C 'els':193C 'end':147C 'escap':55B,130C 'export':100C 'field':69B,146C 'file':44B,119C,173C 'find':7A 'flow':188C 'follow':153C 'front':215C 'generat':30B,108C,240C 'gerrit':17B,208C 'handler':230C 'hold':181C 'html':2A,23B,28B,37B,91C,97C,101C,107C,157C 'impact':250C 'ingest':178C 'inject':8A 'inlin':229C 'input':159C 'insid':46B 'jenkin':18B,200C,218C 'json.dumps':51B,126C,127C 'land':251C 'less':58B,133C 'less-than':57B,132C 'let':4A 'markup':80B 'messag':40B,112C 'name':42B,115C 'one':210C,257C 'open':87B 'output':106C 'packag':19B 'pars':99C,155C 'parti':171C 'path':45B,120C 'place':38B 'plist':21B,35B,95C 'plist-to-html':20B,34B,94C 'post':203C 'probabl':235C 'product':182C 'publish':255C 'put':109C 'report':3A,25B,29B,39B,89B,92C,111C,176C,198C,241C 'report-convert':24B,175C 'restrict':223C 'result':172C 'review':209C 'run':81B 'safe':236C 'script':9A,48B,63B,74B,123C,139C,149C 'serv':219C 'set':242C 'somebodi':192C 'sourc':118C 'state':213C 'store':183C 'tag':64B,140C 'third':170C 'third-parti':169C 'three':145C 'tree':166C 'url':205C 'use':50B 'usercont':201C,220C 'viewer':190C 'wherev':252C 'whoever':86B,162C 'without':256C 'worth':212C 'would':226C 'write':196C","nicknames":[],"mitigations":[],"who_affected":"Teams that generate HTML reports from CodeChecker or plist-to-html and publish them where others open them, especially when the analysed code or third-party result files are not fully trusted. The sources say Jenkins userContent under a restrictive CSP would likely block the injected inline script, but the generated report sets no CSP of its own, so reports served without one are exposed. Teams that only read reports locally from trusted input can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["codechecker","gerrit","jenkins","medium","package","plisttohtml","reportconverter"],"campaign_type":null,"search_a":"'-2026':11A,14A '-84164':12A,15A 'codecheck':1A 'craft':6A 'cve':10A,13A 'find':7A 'html':2A 'inject':8A 'let':4A 'report':3A 'script':9A","search_b":"'attack':78B 'block':49B 'break':70B 'browser':84B 'charact':60B 'checker':41B 'close':62B 'codecheck':16B,32B 'convert':26B 'element':75B 'escap':55B 'field':69B 'file':44B 'generat':30B 'gerrit':17B 'html':23B,28B,37B 'insid':46B 'jenkin':18B 'json.dumps':51B 'less':58B 'less-than':57B 'markup':80B 'messag':40B 'name':42B 'open':87B 'packag':19B 'path':45B 'place':38B 'plist':21B,35B 'plist-to-html':20B,34B 'report':25B,29B,39B,89B 'report-convert':24B 'run':81B 'script':48B,63B,74B 'tag':64B 'use':50B 'whoever':86B","search_c":"'analys':165C 'author':160C 'block':124C,227C 'caveat':211C 'charact':135C 'checker':114C 'close':138C 'cmd':104C,186C 'codecheck':98C,103C 'configur':238C 'control':163C 'convert':177C 'csp':224C,244C 'destin':233C 'diff':105C,187C 'docs/jenkins_gerrit_integration.md':194C 'document':195C 'element':150C 'els':193C 'end':147C 'escap':130C 'export':100C 'field':146C 'file':119C,173C 'flow':188C 'follow':153C 'front':215C 'generat':108C,240C 'gerrit':208C 'handler':230C 'hold':181C 'html':91C,97C,101C,107C,157C 'impact':250C 'ingest':178C 'inlin':229C 'input':159C 'jenkin':200C,218C 'json.dumps':126C,127C 'land':251C 'less':133C 'less-than':132C 'messag':112C 'name':115C 'one':210C,257C 'output':106C 'pars':99C,155C 'parti':171C 'path':120C 'plist':95C 'plist-to-html':94C 'post':203C 'probabl':235C 'product':182C 'publish':255C 'put':109C 'report':92C,111C,176C,198C,241C 'report-convert':175C 'restrict':223C 'result':172C 'review':209C 'safe':236C 'script':123C,139C,149C 'serv':219C 'set':242C 'somebodi':192C 'sourc':118C 'state':213C 'store':183C 'tag':140C 'third':170C 'third-parti':169C 'three':145C 'tree':166C 'url':205C 'usercont':201C,220C 'viewer':190C 'wherev':252C 'whoever':162C 'without':256C 'worth':212C 'would':226C 'write':196C","first_public_at":"2026-11-05T16:35:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84164","severity":null,"published_at":"2026-11-06T11:17:17+00:00","modified_at":"2026-11-06T11:17:17+00:00","first_seen_at":"2026-11-06T11:41:29+00:00","fetched_at":"2026-11-06T11:41:29+00:00","note":null}],"documents":[{"id":85915,"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-6w9g-677j-q2xq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T16:35:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}